Check breached passwords in Go before storing them

package main

import (
	"bufio"
	"bytes"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

var client = &http.Client{Timeout: 5 * time.Second}

// breachedCount reports how often password appears in breach data.
// It never logs the password or includes it in returned errors.
func breachedCount(password string) (int64, error) {
	body, _ := json.Marshal(struct {
		Password string `json:"password"`
	}{password})
	for attempt := 0; attempt < 3; attempt++ {
		req, _ := http.NewRequest(http.MethodPost, "https://api.finowl.co/v1/breaches/password", bytes.NewReader(body))
		req.Header.Set("Authorization", "Bearer "+os.Getenv("FINOWL_API_KEY"))
		req.Header.Set("Content-Type", "application/json")
		resp, err := client.Do(req)
		if err != nil {
			return 0, fmt.Errorf("password check request failed: %w", err)
		}
		var out struct {
			Breached bool
			Count    int64
			Error    struct{ Code string }
		}
		_ = json.NewDecoder(resp.Body).Decode(&out)
		resp.Body.Close()
		switch {
		case resp.StatusCode == http.StatusOK:
			return out.Count, nil
		case resp.StatusCode == http.StatusBadRequest:
			return 0, fmt.Errorf("password failed validation: %s", out.Error.Code)
		case resp.StatusCode == http.StatusUnauthorized:
			return 0, fmt.Errorf("unauthorized: check FINOWL_API_KEY")
		case resp.StatusCode == http.StatusTooManyRequests && out.Error.Code == "rate_limited":
			secs, _ := strconv.Atoi(resp.Header.Get("Retry-After"))
			time.Sleep(time.Duration(max(secs, 1)) * time.Second)
		default:
			return 0, fmt.Errorf("password check failed: %d %s", resp.StatusCode, out.Error.Code)
		}
	}
	return 0, fmt.Errorf("password check still rate limited")
}

func main() {
	fmt.Print("Password to check: ")
	line, _ := bufio.NewReader(os.Stdin).ReadString('\n')
	count, err := breachedCount(strings.TrimRight(line, "\r\n"))
	if err != nil {
		log.Fatal(err)
	}
	if count > 0 {
		fmt.Printf("Seen %d times in breach data. Choose another password.\n", count)
	} else {
		fmt.Println("Not found in breach data.")
	}
}